a GAO GAO MONEY LAUNDERING Extent of Money Laundering through Credit Cards Is Unknown

Transcription

1 GAO United States General Accounting Office Report to the Chairman, Permanent Subcommittee on Investigations, Committee on Governmental Affairs, U.S. Senate July 2002 MONEY LAUNDERING Extent of Money Laundering through Credit Cards Is Unknown a GAO

2 Contents Letter 1 Results in Brief 3 Background 6 The Extent to Which Credit Cards Are Used in Money Laundering Is Unclear 15 Industry Focus Is on Fraud and Credit Risk, Not Money Laundering 19 Regulatory Oversight for Anti Money Laundering Requirements Is Not Focused on Credit Card Operations 28 Agency Comments and Our Evaluation 33 Appendixes Tables Appendix I: Scope and Methodology 35 Appendix II: Demographic Information about the Credit Card Issuers, Acquirers, and Processors in Our Review 37 Appendix III: Organizational Structure of the Associations in Our Review 40 Appendix IV: Observations on Money Laundering Scenarios 47 Appendix V: Review of SAR Database on Potential Money Laundering through Credit Cards 53 Table 1: Key Anti Money Laundering Provisions and the Entities in the Credit Card Industry to Which They Apply 8 Table 2: Number and Dollar Value of Electronic Payments Transferred through U.S. Payment Systems in Table 3: Selected Characteristics of the Issuers in GAO s Review (Year Ending 2001) 37 Table 4: Selected Characteristics of Acquirers in GAO s Review (Year Ending 2001) 38 Table 5: Selected Characteristics of Credit Card Processors in GAO s Review (Year Ending 2001) 39 Figures Figure 1: Money Laundering Stages 7 Figure 2: Typical Credit Card Transaction 13 Page i

3 Contents Abbreviations AML BSA CTR FATF FinCEN NCCT OFAC SAR Anti Money Laundering Bank Secrecy Act Currency Transaction Report Financial Action Task Force Financial Crimes Enforcement Network Non-Cooperative Countries and Territories Office of Foreign Assets Control Suspicious Activity Report Page ii

4 AUnited States General Accounting Office Washington, D.C July 22, 2002 Leter The Honorable Carl Levin Chairman, Permanent Subcommittee on Investigations Committee on Governmental Affairs United States Senate Money laundering the process of disguising or concealing illicit funds to make them appear legitimate is a serious issue, with an estimated $500 billion laundered annually, according to the United Nations Office of Drug Control and Crime Prevention. The terrorist attacks of September 11, 2001, heightened concerns about money laundering and terrorist financing and prompted the enactment of the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism, (USA PATRIOT) Act of 2001 (the Patriot Act). 1 The goals of the Patriot Act include strengthening measures to prevent the supply of terrorist funding and strengthening the ability of the United States to prevent, detect, and prosecute international money laundering. As part of the subcommittee s efforts to combat money laundering, you asked us to review the vulnerabilities to money laundering that may exist in the credit card industry and the industry s efforts to address such vulnerabilities. Money laundering has three stages: placement, where illicit cash is converted into monetary instruments or deposited into financial system accounts; layering, where the funds are moved to other financial institutions; and integration, where these funds are used to acquire assets or fund further activities. The credit card industry includes: credit card associations (associations), such as VISA and MasterCard, which license their member banks to issue bankcards, or authorize merchants to accept those cards, or both; 2 issuing banks, which solicit potential customers and issue the credit cards; 1 Pub. L , 115 Stat 272 (October 26, 2001). Title III of this act institutes new anti money laundering requirements on all financial institutions and gives the U.S. Department of the Treasury the power to impose additional obligations on them as well. 2 American Express and Discover Card were also included in our scope. They are not associations, but are full-service credit card companies that issue their own brand cards directly to customers and authorize merchants to accept their cards. Page 1

5 acquiring banks, which process transactions for merchants that accept credit cards; and third-party processors, which contract with issuing or acquiring banks to provide transaction processing and other credit card related services for the banks. As agreed with your staff, the objectives of this report are to describe (1) vulnerabilities to money laundering that may exist in the credit card industry, (2) efforts by the industry to address potential vulnerabilities to money laundering using credit cards, and (3) existing regulatory mechanisms to oversee the credit card industry and help ensure the adequacy of required anti money laundering (AML) programs. In completing our review, we interviewed U.S. bank regulatory officials and representatives of the associations, major issuing and acquiring banks, and third-party processors. The credit card entities included in our review made up a significant portion of the U.S. credit card industry. From industry representatives, we requested documentation of existing AML programs both broad AML programs and those specifically targeted for credit cards. However, only three institutions provided this documentation. The others described their AML programs but were unwilling to provide documentation to support their descriptions because of concern about the confidentiality of proprietary policies. Our summary of industry efforts was therefore based primarily on testimonial evidence. We also requested documentation from the credit card associations related to the reviews they conducted on offshore banks that were identified in a Senate Permanent Subcommittee on Investigations report on Correspondent Banking. 3 We received documentation from one association. The other association did not provide any documentation, citing, among other things, confidentiality laws in these offshore jurisdictions as a reason for not providing us with the documentation. They also told us that they could not locate the paperwork with respect to the reviews they conducted on these offshore banks. 3 Correspondent Banking: A Gateway to Money Laundering, U.S. Senate Permanent Subcommittee on Investigations, Feb. 5, Page 2

6 We also interviewed law enforcement officials and asked the Financial Crimes Enforcement Network 4 (FinCEN) of the U.S. Department of the Treasury (Treasury) to analyze the government s database on Suspicious Activity Reports (SAR) and identify and quantify reports related to potential money laundering through credit cards. Appendix I contains more detailed information on the scope and methodology of our review. Appendix II provides detailed information on the entities in the industry that we interviewed. Results in Brief The extent to which money laundering through credit cards may be occurring is unknown. Bank regulators, credit card industry representatives, and law enforcement officials we interviewed generally agreed that credit card accounts were not likely to be used in the initial stage of money laundering when illicit cash is first placed into the financial system, because the industry generally restricts cash payments. Bank regulators and credit card industry representatives we interviewed acknowledged that credit card accounts might be used in the layering or integration stages of money laundering. For example, by using illicit funds already placed in a bank account to pay a credit card bill for goods purchased, a money launderer has integrated his illicit funds into the financial system. Most law enforcement officials we met with were unable to cite any specific cases of credit card facilitated money laundering in U.S. based financial institutions. Further, a FinCEN analysis of its database of SARs filed by U.S.-based financial institutions revealed very little evidence of potential money laundering through credit cards. However, evidence from a congressional investigation showed that credit card accounts accessed through banks in certain offshore financial secrecy jurisdictions 5 could be vulnerable to money laundering. In addition to the 4 FinCEN was established in 1990 to support law enforcement agencies by analyzing and coordinating financial intelligence information to combat money laundering. The agency is also responsible for promulgating regulations under certain provisions of the Bank Secrecy Act. 5 The Internal Revenue Service defines financial secrecy jurisdictions as jurisdictions that have a low or zero rate of tax, a certain level of banking or commercial secrecy, and relatively simple requirements for licensing and regulating banks and other business entities. In this report, we use the term offshore jurisdictions to refer to financial secrecy jurisdictions. Page 3

7 cases described in the Permanent Subcommittee s February 2001 report, 6 the Internal Revenue Service s Criminal Investigation group has investigated cases of U.S. citizens placing funds in bank accounts in these jurisdictions in order to evade U.S. taxes and accessing the funds through the use of credit cards. Industry representatives generally reported that they did not have AML policies and programs focused on credit cards because they considered money laundering using credit cards to be unlikely. In their view, the banks application screening processes, systems to monitor fraud, and policies restricting cash payments and prepayments 7 made credit cards less vulnerable to money laundering. Industry representatives also described policies and programs to minimize financial risks of credit card fraud, which they believed to be helpful in detecting money laundering. For example, the major associations told us that they monitor card transactions for potential fraud and report the results of their monitoring to member banks, which may use the information to investigate and report activities that the banks consider suspicious. Association officials also told us they applied the same due diligence procedures for domestic and foreign issuing and acquiring banks. At the time of our review, this due diligence did not include anti-money laundering screening. Credit card issuing and acquiring institutions told us that they screen applications and monitor transactions through automated systems for unusual or out-of-pattern transactions and, as a result of these efforts, may conduct investigations, file SARs, or work with law enforcement. The major third-party credit card processors in our study told us that they incorporated fraud prevention and detection policies and programs into their transaction processing systems for the issuers and acquirers. Although most of the industry representatives indicated that their fraud controls might also identify money laundering, they were unable to cite any cases of money laundering identified as a result of their fraud controls. The lack of money laundering cases identified through these fraud controls and the lack of indications of money laundering through suspicious activity reporting might be attributed to such factors as a lack of money laundering occurring through U.S.-based credit card operations or the inadequacy of current fraud-focused procedures and systems to identify money laundering. Treasury believes 6 Correspondent Banking: A Gateway to Money Laundering, U.S. Senate Permanent Subcommittee on Investigations, Feb. 5, A prepayment is a payment made to a credit card account in an amount that exceeds the total balance of the account and can result in a large overpayment. Page 4

8 that the systems the industry uses to monitor fraud are a starting point for appropriate anti money laundering safeguards, but alone they are not sufficient. Treasury believes that while AML programs should be built upon existing anti-fraud programs, additional factors and considerations specific to money laundering must be included. At the time of our review, the primary regulatory oversight mechanism to help ensure the adequacy of AML programs was the Bank Secrecy Act (BSA) examination, which applied, in the credit card industry, to issuing and acquiring banks. The regulators told us that, in their view, the issuing banks application screening process, fraud monitoring systems, and policies generally restricting cash payments lowered the risk of money laundering through credit cards. Consequently, regulators focused less on credit card operations in conducting their BSA examination than on other areas that they considered at higher risk to money laundering, such as private banking and wire transfers. Although acquiring banks are subject to the BSA, the regulatory oversight of these entities has focused more on safety and soundness issues because regulators do not view these entities as being at high risk for money laundering. The associations and third-party processors are currently subject to regulatory oversight solely focused on the data processing systems and internal controls of these entities, to ensure that these entities do not pose risks to the banks they service. The Patriot Act required the associations to have AML programs by April 24, Interim final rules issued by Treasury on April 24, 2002, require the associations anti money laundering program to be in writing, approved by senior management, and to be reasonably designed to prevent the credit card system from being used to launder money or to finance terrorist activities. Under BSA regulations, the Internal Revenue Service is the regulatory body that will oversee the associations adherence to the new requirements, unless Treasury delegates this authority to another agency. We make no recommendations in this report. We asked Treasury and two of its bureaus, the Office of the Comptroller of the Currency and FinCEN, to comment on this report. We also asked the Board of Governors of the 8 Section 352 (a) of the Patriot Act amends section 5318(h) of the BSA. As amended, section 5318(h)(1) of the BSA requires every financial institution to establish an anti money laundering program. As operators of credit card systems are identified as financial institutions under the BSA, 31 U.S.C. 5312(a)(2)(L), they are subject to the anti money laundering program requirements. Treasury, in its interim final rule, defined an operator of a credit card system. This definition includes credit card associations as operators of a credit card system. Page 5

9 Federal Reserve System and the Federal Deposit Insurance Corporation for their comments on it. The agencies generally agreed with the information presented in the report and provided us with technical changes or factual updates, which we have incorporated where appropriate. Background Individuals engaged in illicit activities must eventually introduce their illegally gained money into the nation's legitimate financial systems, according to FinCEN. Money laundering involves disguising financial assets so they can be used without detection of the illegal activity that produced them. Through money laundering, the criminal transforms the monetary proceeds derived from criminal activity into funds with an apparently legal source. Money laundering provides the fuel for drug dealers, terrorists, arms dealers, and other criminals to operate and expand their criminal enterprises. FinCEN notes that criminals are able to use financial systems in the United States and abroad to further a wide range of illicit activities. Money laundering generally occurs in three stages, as shown in figure 1. In the first, or placement, stage, cash is converted into monetary instruments, such as money orders or travelers checks, or deposited into financial institution accounts. The later stages of money laundering are the layering and integration stages. In the layering stage, the funds already placed are transferred or moved into other accounts or other financial institutions to further obscure their illicit origin. In the integration stage, the funds are used to purchase assets in the legitimate economy or to fund further activities. Page 6

10 Figure 1: Money Laundering Stages Source: FinCEN Related Series: An Assessment of Narcotics Related Money Laundering, FinCEN, July Page 7

11 AML Requirements for the Credit Card Industry AML requirements for financial institutions focus on mandating that the financial institutions keep records and file reports for certain types of transactions and establish programs to prevent and detect money laundering. 9 Table 1 shows some of the key anti money laundering requirements and the entities in the credit card industry to which they apply. Table 1: Key Anti Money Laundering Provisions and the Entities in the Credit Card Industry to Which They Apply Statute and regulations Some key provisions Associations 1970 Bank Secrecy Act (31 U.S.C. 5313) 31 C.F.R BSA authorizes Treasury to promulgate regulations for transactions in currency. Requires reports to FinCEN of receipts or transfers of U.S. currency in excess of $10,000 using the Currency Transaction Report (CTR). Also requires reporting of all known receipts or transfers by one entity that exceed $10,000 in 1 day. a X Issuing banks X X Acquiring banks X X 31 U.S.C & 31 C.F.R Money Laundering Control Act of 1986 (18 U.S.C and 1957) 1992 Annunzio-Wylie Money Laundering Act (31 U.S.C. 5318(h)) Requires the reporting of cash transactions over $10,000 on Form Makes it a criminal offense to knowingly engage in financial transactions that involve profits from certain illegal activities. Gives the Secretary of the Treasury authority to promulgate regulations requiring financial institutions to establish AML programs. X X X X X X X 9 Financial institutions cannot issue or sell bank checks and drafts, cashiers checks, money orders, or travelers checks for $3,000 or more in currency without recording certain information and verifying the identity of the purchaser. 31 C.F.R (a) (2001). Additionally, each financial institution must retain for a period of 5 years the records of certain transactions that exceed $10,000, including records of each extension of credit in an amount that is greater than $10, C.F.R (2001). Page 8

12 (Continued From Previous Page) Statute and regulations Some key provisions Associations 1992 Annunzio-Wylie Money Laundering Act (31 U.S.C. 5318(g)) 1996, Suspicious Activity Reporting Rule for banks and other depository institutions, 31 C.F.R October 26, 2001, U.S. Patriot Act, Section 326 October 26, 2001, U.S. Patriot Act, Section 352 April 24, 2002, Financial Crimes Enforcement Network; Anti Money Laundering Programs for Operators of a Credit Card System October 26, 2001, U.S. Patriot Act, Section 313 Amends the BSA and authorizes the Treasury to require any financial institution and its officers, directors, employees, and agents to report any suspicious transaction relevant to possible violation of law or regulation. Requires banks and other depository institutions to report suspicious activities for transactions involving $5,000 or more to FinCEN. a Requires Treasury to issue regulations, effective October 26, 2002, to establish minimum procedures for financial institutions to use in verifying the identity of a customer during the account opening process. Requires financial institutions to establish anti money laundering programs by April 24, 2002, that address: (i) the development of internal policies, procedures, and controls; (ii) the designation of a compliance officer; (iii) an ongoing employee training program; and (iv) an independent audit function to test this program. Defines operator of a credit card system and requires each operator to have a written anti money laundering program with certain minimum standards by July 24, The program must be approved by senior management and reasonably designed to prevent the system from being used to launder money or finance terrorist activities. Bars (as of December 25, 2001) certain financial institutions from maintaining correspondent bank accounts for foreign shell banks (that is, a bank that does not have a physical presence in any country). b X X X X X X Issuing banks a Regulations concerning currency transaction reports and suspicious activity reports are not applicable to associations. b An insured bank, a commercial bank, a private banker, an agency or branch of a foreign bank in the United States, an insured institution as defined in 12 U.S.C. 1724(a), a thrift, or broker/dealer. Source: BSA, BSA Regulations, and the Patriot Act. Financial institutions are also required to abide by regulations developed by the Office of Foreign Assets Control (OFAC). OFAC, which is a division of Treasury, administers and enforces economic and trade sanctions against targeted foreign countries, terrorism-sponsoring organizations, and international narcotics traffickers. On the basis of U.S. foreign policy and national security goals, OFAC promulgates regulations and develops and X X X X Acquiring banks X X X X Page 9

13 administers sanctions for Treasury under eight statutes. In general, financial institutions are required when so instructed by OFAC to block the accounts and other assets of specified countries, entities, and individuals. OFAC has authority to impose civil penalties when financial institutions fail to comply. Financial institutions are also advised by regulators to enhance their scrutiny of certain transactions and banking relationships in jurisdictions deemed by FinCEN to have serious deficiencies in their anti money laundering systems. The jurisdictions identified by FinCEN are consistent with the Financial Action Task Force s (FATF) 10 list of Non-Cooperative Countries and Territories (NCCT). 11 Federal banking regulators examine banks to determine whether their policies, procedures, and internal controls are adequate with respect to BSA, AML, and OFAC laws and regulations. The regulators generally are required to take the following steps in assessing the banks: Determine whether bank management has adopted and implemented adequate policies and procedures related to BSA, AML, and OFAC. These policies are expected to address the identification and reporting of money laundering in its different forms (that is, placement, layering, and integration). Ensure that these policies cover all products and units in the bank, including credit cards. Verify that the bank s board has approved a written compliance program that ensures compliance with all reporting and record-keeping requirements of the BSA, including SAR requirements. This includes 10 The FATF, with 28 member countries, is an intergovernmental body established in 1989 to promote policies to combat money laundering. In 1990, FATF issued an initial report containing 40 recommendations for fighting money laundering. 11 In , FATF began a process to identify jurisdictions with serious deficiencies in anti money laundering regimes. As a result, FATF published a report in June 2000 listing 15 jurisdictions with serious deficiencies in their anti money laundering efforts. These jurisdictions were placed on the NCCT list of the FATF. FATF published additional reports in June and September 2001 that resulted in the removal of four countries from NCCT status and the addition of eight new NCCTs. As of this writing, there are 19 countries designated by FATF as NCCTs. FATF calls on its members to request that their financial institutions give special attention to businesses and to transactions with persons in countries identified as being noncooperative when these businesses or persons do not rectify the situation. Page 10

14 independent testing for compliance, designation of a qualified individual or individuals for coordinating and monitoring day-to-day compliance, and training for appropriate personnel. Determine the effectiveness of the bank s processes in identifying risk. The regulators expect that banks will conduct a risk assessment of their customer base to determine the appropriate level of necessary due diligence. The regulators also determine whether a bank 1) has filed the required BSA reports; 2) has maintained the required BSA records; 3) can detect structuring; and 4) has an effective overall system to monitor, identify, review, and report suspicious activity. The Credit Card Industry Is Composed of Various Entities The credit card industry is composed of the following four types of entities: Associations, which are jointly owned by member financial institutions, provide the computer systems that transfer data between member institutions. The associations also establish the operating standards that define the policies, roles, and responsibilities of their member institutions. Most member institutions issue credit cards, or sign up merchants to accept credit cards, or both. Providing direct services to consumers and merchants is the responsibility of the member institutions rather than of the associations. The major associations are VISA and MasterCard. Appendix III provides more information on the organizational structure of VISA and MasterCard. Although not an association, American Express has arrangements in some overseas markets for licensing foreign banks to issue American Express cards. This creates relationships similar to those that VISA and MasterCard have with their issuing card member banks. Issuing banks solicit potential customers and issue the credit cards. These banks carry the credit card loan and set policies for matters such as credit limits for cardholders and treatment of delinquent cardholders. These banks maintain all account information on the cardholder. In many respects, American Express and Discover Card act as issuing banks. That is, they issue their own brand cards. They also sign up the cardholder, settle the transactions, and maintain all account information on the cardholder. Acquiring banks, also known as merchant banks, sign up merchants to accept credit cards. These banks settle the credit card transactions and maintain all account information on their merchant clients. American Page 11

15 Express and Discover Card also perform many merchant bank functions. For the most part, they sign up merchants directly, settle accounts, and maintain all account information on their merchants. Third-party credit card processors process credit card transactions for the issuing or acquiring banks that contract with them to perform these services. These processors also perform a range of other functions for issuing and acquiring banks, including embossing cards for issuing banks or soliciting merchants for acquiring banks. Third-party processors are usually able to perform these functions for issuing or acquiring banks at lower cost than the banks because they have reached economies of scale. A specialized group of third-party processors, known as independent sales organizations, mainly solicit merchants on behalf of acquiring banks. Each of the various types of entities plays a role in each credit card transaction, as shown in figure 2. Page 12

16 Figure 2: Typical Credit Card Transaction Source: VISA. Page 13

17 Average Dollar Value of Credit Card Transactions Very Small Compared with Other Forms of U.S. Electronic Payments In 2000, the credit card industry processed a large number of relatively small, average dollar value transactions as compared with other forms of electronic payments, as shown in table 2. During the year, 20 billion of the 72.5 billion (28 percent) electronic payments transferred through U.S. payment systems were made up of credit card transactions. However, the average dollar value of credit card transactions was very small as compared with other forms of electronic payments. For example, the average value of a credit card transaction was $70, which was very small as compared with the average value of transactions for other forms of electronic payments, such as Fedwire and the Clearinghouse Interbank Payment System, which were $3.5 million and $4.9 million, respectively. Table 2: Number and Dollar Value of Electronic Payments Transferred through U.S. Payment Systems in 2000 Daily average Annual System Purpose Number Dollar value Number Dollar value Average value of transaction Fedwire Funds transfer operated by Federal Reserve System, used primarily for domestic payments between financial institutions. 430,000 $1.5 trillion 108 million $380 trillion $3.5 million Clearing House Interbank Payment System (CHIPS) Automated Clearing House (ACH) Automated Teller Machines Credit cards Debit cards a Privately owned large dollar value payments transfer system used primarily for settling foreign exchange transactions. Systems operated by the Federal Reserve System and private organizations to transmit electronic payments for retail purposes. Cash dispensing and account fund transfers. Payments for goods and services through third-party financial institutions. Payments for goods and services directly from payor s financial institution. 237, trillion 60 million 292 trillion 4.9 million 120 million b 28 billion b 30 billion 7 trillion million b 3.2 billion b 13 billion 800 billion million b 5.6 billion b 20 billion 1.4 trillion million b 1.6 billion b 9.3 billion 400 billion 43 Total 290 million $2.74 trillion 72.5 billion $682 trillion a Includes both on-line and off-line transactions. b Estimated from annual data by assuming 250 business days per year. Source: Federal Reserve Board of Governors, New York Clearing House, and National Automated Clearing House Association. Page 14

18 The Extent to Which Credit Cards Are Used in Money Laundering Is Unclear The consensus from industry, bank regulatory, and law enforcement officials we interviewed was that credit card accounts were not likely to be used in the initial stage of money laundering when illicit cash is first placed in the financial system, primarily because of restrictions on cash payments. Some credit card industry representatives and bank regulators we interviewed acknowledged that credit cards could be used in the layering or integration stages of money laundering; however, the extent to which this may be occurring is unknown. These officials, as well as most law enforcement officials we spoke with, were not aware of any cases of money laundering through credit cards in U.S.-based institutions. An analysis of FinCEN s SAR database also did not identify any instances in which the suspicious activity reported by financial institutions developed into an actual case of money laundering. However, we received information from one law enforcement agency that individuals have used credit cards to access illicit funds held in banks or trusts established in certain offshore jurisdictions. Credit Cards Are Unlikely to Be Used in Placement Stage, but Their Use in the Later Stages of Money Laundering Is Unknown Credit cards are not likely to be used to place illicit funds in the U.S. financial system because of restrictions on cash payments, according to industry, bank regulatory, and law enforcement officials we interviewed. For example, most issuers and acquirers told us that they did not accept cash payments for credit card accounts and generally restricted payments to checks. Some industry and regulatory officials indicated that credit cards would be an ineffective way to launder money because each transaction creates a paper trail. They also indicated that credit cards would be an inefficient way to launder funds because of the limits on access to cash. Nevertheless, some of these officials acknowledged that credit cards could be used at the layering and integration stages of money laundering; however, the extent to which this may be occurring is unknown. They indicated that once money launderers had placed their illicit funds in the financial system, they could layer and integrate the funds using credit card accounts. These officials provided us with examples of how this could occur: The money launderer prepays his credit card using funds already in the banking system, creating a credit balance on the account. The launderer then requests a credit refund, which enables him to further obscure the origin of the funds, which is layering. Page 15

19 The money launderer uses the illicit funds that are already in the banking system to pay his credit card bill for goods purchased, which is an example of integration. Officials from one bank told us that once its bank receives a check payment for a credit card account, it has no way of knowing how the funds were put into the system, let alone the origin of funds. Officials from another bank stated that if a money launderer were able to deposit funds into another institution, they could easily obtain a credit card. Appendix IV contains information on six money-laundering scenarios that we discussed with industry and regulatory officials. Although industry and regulatory officials acknowledged that credit cards could be used in the layering or integration stages of money laundering, they, along with most law enforcement officials we interviewed, were unaware of actual cases in which credit cards were used to launder money through U.S.-based financial institutions. An analysis of FinCEN s database of SARs filed by U.S.-based financial institutions also did not identify any instances in which the suspicious activity reported by the financial institution developed into actual cases, but it provided some insights about possible money laundering linked to the use of credit cards. The database analysis FinCEN conducted in response to our request found that some banks had filed SARs pertaining to possible money laundering/ BSA/structuring violations and credit, debit, 12 or ATM cards. 13 FinCEN conducted an analysis of the database and found that between October 1, 1999, and September 30, 2001, banks had filed 499 SARs related to credit, debit, or ATM cards and potential money laundering. This represents a significantly small percentage of the total of all SARs filed in this period: about one-tenth of 1 percent. FinCEN s analysis identified some examples of the type of suspicious activity banks reported that related to the layering and integration stages of money laundering: 12 A debit card is a plastic card that is tied directly to an individual s checking or savings account. The debit card has the logo of one of the major associations, allowing the individual to make a purchase with the card from merchants who accept the association s credit cards. Transactions from debit cards are quickly deducted from the individual s checking or savings account, which differs from a credit card transaction, which the individual pays at a later date. 13 The ATM card is a plastic card that, like the debit card, is tied directly to an individual s checking or savings account. It can be considered a debit card if it contains the logo of a major association. The ATM card is used to conduct banking business at an Automatic Teller Machine, such as depositing or withdrawing funds or checking on account balances. Page 16

20 Fifteen of the 499 SARs related to customers overpaying their credit cards and subsequently asking for refund checks. FinCEN noted that overpaying a credit card could be used as a means to launder money because it provides a simple means to convert criminal or suspicious funds to a bank instrument with minimal or no questions as to the origin of the funds. One hundred fifteen of the 499 SARs related to customers trying to structure deposits that is, making multiple deposits below the $10,000 threshold that would trigger a bank s filing a Currency Transaction Report (CTR). Most of these SARs related to cash transactions wherein the customer asked to deposit funds into various accounts, pay down loans, purchase cashiers checks, and make credit card payments. FinCEN noted that the total payments on the credit cards were typically well over $5,000 and often exceeded $10,000. FinCEN noted that the activity reported in virtually all of the SARs was considered an isolated incidence by the reporting banks. The only exception involved six SARs filed in early 2001 by the same bank, which reflects some kind of organized or criminal activity involving credit cards. Specifically, this bank filed SARs on four suspects. The bank reported that check payments credited to the four suspects credit card accounts were made by a fifth individual. The individual making the payments on these accounts had earlier been indicted on money laundering, contraband, cigarette smuggling, and visa/immigration fraud charges. Of the 499 SARs that FinCEN identified, 70 were referred directly to law enforcement by the financial institution, in addition to being filed with FinCEN. FinCEN was unable to tell us if any of them resulted in money laundering cases. Appendix V contains more details on the FinCEN analysis of the SAR database. Page 17

21 Credit Card Accessed Accounts in Offshore Banks Create Vulnerabilities to Money Laundering One U.S. law enforcement agency has found instances of the use of credit cards associated with bank accounts in offshore jurisdictions to launder money, but the extent of this activity is unknown. For example, the Internal Revenue Service s Criminal Investigation group has found that U.S. citizens have placed funds intended to evade U.S. taxes in accounts at banks or trusts in certain offshore jurisdictions and then accessed these funds using credit and debit cards associated with the offshore account. In other instances, individuals generating cash from illegal activities have smuggled the cash out of the United States into an offshore jurisdiction with lax regulatory oversight, placed the cash in offshore banks, and again accessed the illicit funds using credit or debit cards. The credit or debit card provides a money launderer access to the cash received through the criminal activity without having to be concerned about a CTR or SAR being filed, according to this law enforcement agency. A United Nations report on offshore jurisdictions 14 reported that credit cards are a common and nontraceable means by which individuals access their funds in these offshore jurisdictions. The report indicated that banks assure cardholders that their account information will be protected by strict bank secrecy laws in these jurisdictions. The Senate Permanent Subcommittee on Investigations report on Correspondent Banking describes two cases in which offshore banks engaged in money laundering, provided their clients with credit or debit cards to access their illicit funds. Guardian Bank and Trust (Cayman) Ltd., was an offshore bank licensed in the Cayman Islands. Its owner, who pleaded guilty to money laundering, tax evasion, and fraud, described how the bank allowed U.S. citizens to establish accounts with the bank for the purpose of evading taxes. The owner promoted the use of credit or debit cards so that his clients could covertly access funds stored in the Cayman Islands. He stated that these techniques were promoted and used to evade U.S. taxation. Caribbean American Bank, which was licensed in Antigua and Barbuda, was involved in a major fraud scheme. Through its relationship with another bank, it was able to offer its clients credit cards to charge purchases. The balance on the card was paid out of the illicit proceeds the clients had on deposit at Caribbean American Bank. 14 Financial Havens, Banking Secrecy and Money Laundering, United Nations Office for Drug Control and Crime Prevention, Global Programme Against Money Laundering, May 29, Page 18

22 Industry Focus Is on Fraud and Credit Risk, Not Money Laundering Industry representatives of most of the entities we reviewed told us that they did not have AML policies and programs specifically focused on the issuance and use of credit cards because they considered money laundering through the use of credit cards to be unlikely. They indicated that issuing and acquiring banks application screening processes, systems to monitor fraud, and policies restricting cash payments and prepayments made credit cards less vulnerable to money laundering. The credit card industry had a variety of policies and programs aimed at reducing the industry s losses from fraud and credit risk, which are the major financial risks in the credit card industry. 15 For example, credit card issuing and acquiring institutions told us that they screen applications and monitor transactions through automated systems for unusual or out-of-pattern transactions and, as a result of these efforts, may conduct investigations, file SARs, or work with law enforcement. Industry representatives and some regulatory and law enforcement officials we interviewed believed these policies and programs could also help identify possible money laundering through credit cards; however, none of them had evidence that the fraud systems identified money laundering. The lack of evidence of money laundering identified through the fraud systems could be attributed to such factors as a lack of money laundering occurring through U.S.-based credit card operations or the inadequacy of current fraud-focused procedures and systems to identify money laundering. Treasury believes that the systems the industry used to monitor fraud are a good starting point for AML safeguards, but the industry must also include additional factors and considerations specific to money laundering. Credit Card Associations Are Required to Have Anti Money Laundering Programs as a Result of the Patriot Act The associations approaches to addressing AML issues have changed significantly as a result of the Patriot Act, according to association officials. At the start of our review, the provisions of the Patriot Act requiring all financial institutions to have AML programs in place were not yet in effect, and Treasury had not issued regulations requiring credit card associations to have in place AML policies and programs. Representatives of the two major credit card associations we interviewed at that time did not view credit cards as being at high risk for money laundering. They also did not 15 Fraud results in financial losses to the industry and can take the form of stolen or counterfeit credit cards as well as merchants engaging in fraudulent activity. Credit risk also results in financial losses to the industry when, for example, cardholders do not pay their credit card bills or merchants declare bankruptcy and are unable to cover their outstanding charges. Page 19

23 regard the establishment of AML policies and programs as the responsibility of their respective associations. Nevertheless, the association officials believed that their due diligence procedures for membership in the associations for domestic and foreign issuing and acquiring banks, as well as their fraud controls, were useful in identifying suspicious activity. Officials from one of the associations indicated that its fraud controls could possibly identify money laundering, while officials from the other association indicated that its fraud controls were developed strictly to identify fraud, not money laundering. Treasury acknowledges that the associations fraud monitoring is sophisticated but is not convinced that it can easily detect money laundering. The association officials told us that they generally applied the same due diligence procedures for domestic and foreign issuing and acquiring banks. These procedures included: obtaining documentation showing that the bank is licensed and subject to bank supervision and regulation in the jurisdiction where it is licensed; applying underwriting procedures to ensure that the bank is financially sound and can meet its financial obligations; and obtaining assurances that the bank will abide by the association s rules and regulations and comply with applicable host country laws. The association officials told us that the associations did not apply separate due diligence procedures to verify the AML policies and programs of their domestic and foreign issuing and acquiring banks, including banks in NCCT countries. Association officials told us that they relied on host country regulators to ensure that issuing and acquiring banks were not engaged in money laundering activity. As discussed below, the associations due diligence procedures for reviewing their member banks AML programs will change as a result of the Patriot Act. Association officials told us that although the associations did not have formal AML policies or programs before the Patriot Act, they have had longstanding in-house systems to monitor abnormal or unusual card transactions in terms of dollar amounts, locations of purchases, and frequency of charges. The associations monitor these transactions as they pass through the associations networks and related fraud screens. The monitoring systems have helped member banks, some of which must be Page 20

24 subscribers to the associations fraud services, to identify and investigate suspicious activity. The associations reported the results of this monitoring to member banks and, if requested by member banks, have helped them report cases of fraud to the appropriate law enforcement agencies. Officials of one of the associations indicated that this monitoring may also help identify possible money laundering, but they could not cite any cases where money laundering had been identified by their monitoring system. The Patriot Act required the associations to have AML programs by April 24, Treasury has promulgated interim final rules to provide guidance to associations concerning the requirements for the AML programs. Treasury requires that by July 24, 2002, associations have AML programs with certain specified minimum standards. More specifically, associations are required to have policies, procedures, and controls to mitigate the risk for money laundering and terrorist financing; these policies, procedures, and controls are to be focused on the process of authorizing and maintaining authorization for issuing and acquiring banks. Treasury expects the associations to focus their efforts on those banks considered as being at high risk for money laundering. For example, Treasury considers offshore banks in jurisdictions with lax money laundering controls to be high-risk entities. We met with officials of the associations after the enactment of the Patriot Act. At that time, officials of one of the associations told us that as part of their effort to meet the goals of the Patriot Act, they were augmenting their procedures for reviewing all of their member banks to ensure that the association was not at risk for being used for money laundering by one of its member banks. The officials indicated that they would review their entire member base but focus on those members in jurisdictions that are considered to be at high risk for money laundering. For example, they would first focus their efforts on those jurisdictions identified as NCCT by the FATF. Officials from the other association did not provide us with any descriptions of how they might change their procedures for reviewing their member banks, and indicated that they were waiting for Treasury to provide guidance on how they should review these banks. These officials indicated, however, that they would be in compliance with the Patriot Act by the required dates. Page 21

25 Issuers Believe Fraud- Focused Policies and Controls and Restrictions on Cash and Prepayments May Help Counter Money Laundering In the view of the issuers we interviewed, their fraud-focused policies and controls, as well as their restrictions on cash payments and prepayments, can serve to help prevent and detect money laundering via credit cards. However, Treasury believes that while these fraud-focused policies and controls are a starting point for appropriate anti money laundering safeguards, the industry must also consider additional factors and considerations specific to money laundering. Most of the issuers we spoke with had broad AML programs, but only three of the nine in our review had AML policies and programs specifically addressing credit card operations. Nevertheless, all of the issuers told us that they applied fraud and credit risk policies and controls to screen credit card applications and monitored the card transactions of approved cardholders. In addition, issuers told us that they placed restrictions on cash and prepayment transactions. The issuers told us that they had application screening procedures to authenticate the applicant and review the applicant for purposes of identifying potential fraud. The issuers said that they authenticate applicants by verifying employment, address, social security number, or other application information against external sources such as public, credit bureau, or employer records. To review the applicant for potential fraud, some issuers said that they try to match the applicant s name and other identifying information against names and information on public records and industry lists, or negative lists lists containing names and addresses associated with fraudulent activity. Three issuers also said that they declined to process applications with foreign addresses. Most of the issuers, furthermore, told us that they matched the applicant's name and address against the OFAC list of prohibited individuals or entities. The issuers believe that their application screening process, as a whole, enables them to identify and reject applicants who have been associated with fraudulent activity or show a potential for fraud or other criminal activity, including money laundering. However, since the issuers rely on public records or lists of names and addresses known for fraud, the issuers screening process may not capture all fraudulent or criminal activity. For example, applicants who have no negative credit or criminal history would be able to avoid scrutiny and detection under their screening process, according to the issuers. Page 22